xnu-2050.22.13.tar.gz

[apple/xnu.git] / security / mac_internal.h

diff --git a/security/mac_internal.h b/security/mac_internal.h
index 283fef64aee322156bc526a2d27d13b5b99c1a9a..6ca8b699ecf6bc637a981758c18e80978fdf3d91 100644 (file)
--- a/security/mac_internal.h
+++ b/security/mac_internal.h
@@ -184,8 +184,6 @@ extern struct mac_policy_list mac_policy_list;
  * at all in the system.
  */
 extern unsigned int mac_device_enforce;
-extern unsigned int mac_file_enforce;
-extern unsigned int mac_iokit_enforce;
 extern unsigned int mac_pipe_enforce;
 extern unsigned int mac_posixsem_enforce;
 extern unsigned int mac_posixshm_enforce;
@@ -198,11 +196,6 @@ extern unsigned int mac_sysvshm_enforce;
 extern unsigned int mac_vm_enforce;
 extern unsigned int mac_vnode_enforce;
 
-#if CONFIG_MACF_MACH
-extern unsigned int mac_port_enforce;
-extern unsigned int mac_task_enforce;
-#endif
-
 #if CONFIG_MACF_NET
 extern unsigned int mac_label_mbufs;
 #endif
@@ -332,6 +325,44 @@ struct label *mac_mbuf_to_label(struct mbuf *m);
        }                                                               \
 } while (0)
 
+/*
+ * MAC_GRANT performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Unlike MAC_CHECK, it grants if any policies return '0',
+ * and otherwise returns EPERM.  Note that it returns its value via
+ * 'error' in the scope of the caller.
+ */
+#define MAC_GRANT(check, args...) do {                                 \
+       struct mac_policy_conf *mpc;                                    \
+       u_int i;                                                        \
+                                                                       \
+       error = EPERM;                                                  \
+       for (i = 0; i < mac_policy_list.staticmax; i++) {               \
+               mpc = mac_policy_list.entries[i].mpc;                   \
+               if (mpc == NULL)                                        \
+                       continue;                                       \
+                                                                       \
+               if (mpc->mpc_ops->mpo_ ## check != NULL) {              \
+                       if (mpc->mpc_ops->mpo_ ## check (args) == 0)    \
+                               error = 0;                              \
+               }                                                       \
+       }                                                               \
+       if (mac_policy_list_conditional_busy() != 0) {                  \
+               for (; i <= mac_policy_list.maxindex; i++) {            \
+                       mpc = mac_policy_list.entries[i].mpc;           \
+                       if (mpc == NULL)                                \
+                               continue;                               \
+                                                                       \
+                       if (mpc->mpc_ops->mpo_ ## check != NULL) {      \
+                               if (mpc->mpc_ops->mpo_ ## check (args)  \
+                                   == 0)                               \
+                                       error = 0;                      \
+                       }                                               \
+               }                                                       \
+               mac_policy_list_unbusy();                               \
+       }                                                               \
+} while (0)
+
 /*
  * MAC_BOOLEAN performs the designated boolean composition by walking
  * the module list, invoking each instance of the operation, and